Skip to content
Last updated

An Incoming Webhook is an HTTPS endpoint that external systems can POST events to. Each webhook generates a unique URL and, optionally, an access token used to authenticate the caller. Workflows can subscribe to that URL via WEBHOOK trigger nodes and react to the events.

These are inbound only — they don't push notifications out to your systems. (Outbound event delivery, if and when added, will be a separate concept.)

Identity

FieldTypeNotes
idstringCustom prefixed ID (e.g. clx123incomingwebhook).
namestringRequired, min 1 character.
descriptionstring?
urlstringThe HTTPS endpoint to POST to. Generated by Frontline.
isActivebooleanDefault true. When false, the webhook drops incoming requests with 404.
useAuthenticationbooleanDefault true. Controls whether the webhook requires a Bearer token.
accessTokenstring?64-character token. Returned only on create when useAuthentication=true.
createdAtstringISO timestamp.
updatedAtstringISO timestamp.

Authentication modes

  • useAuthentication: true (recommended) — Frontline issues a 64-character access token on create. External callers must POST with Authorization: Bearer <accessToken>. The token is only returned in the create response; if you lose it, rotate the webhook.
  • useAuthentication: false — anyone with the URL can POST. Treat the URL itself as a secret.

Calling a webhook from the outside

curl -X POST "https://hooks.example.com/webhook/clx123incomingwebhook" \
  -H "Authorization: Bearer <accessToken>" \
  -H "Content-Type: application/json" \
  -d '{"contactId":"123","status":"created"}'

The webhook persists the JSON body and exposes it to subscribed Workflow WEBHOOK trigger nodes, which can reference fields with the usual {nodeId} interpolation.

Operations

VerbPathPurpose
POST/public/v1/incoming-webhooksCreate (USER key). Returns URL + token.

The Public API currently only exposes the create endpoint. To list, rotate, or revoke existing webhooks, manage them from the Frontline dashboard.

CLI

frontline incoming-webhooks create --name "CRM payload"
frontline incoming-webhooks create --name "CRM payload" --description "Receives contacts"
frontline incoming-webhooks create --name "Open endpoint" --no-authentication

Store the accessToken from the create response immediately — list/detail commands do not expose it.